Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption

Abstract

This work examines the vulnerability of multimodal (image + text) models to adversarial threats similar to those discussed in previous literature on unimodal (image- or text-only) models. We introduce realistic assumptions of partial model knowledge and access, and discuss how these assumptions differ from the standard "black-box"/"white-box" dichotomy common in current literature on adversarial attacks. Working under various levels of these "gray-box" assumptions, we develop new attack methodologies unique to multimodal classification and evaluate them on the Hateful Memes Challenge classification task. We find that attacking multiple modalities yields stronger attacks than unimodal attacks alone (inducing errors in up to 73% of cases), and that the unimodal image attacks on multimodal classifiers we explored were stronger than character-based text augmentation attacks (inducing errors on average in 45% and 30% of cases, respectively).

References in corpus (16)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Microsoft COCO Captions: Data Collection and Evaluation Server
• Towards Deep Learning Models Resistant to Adversarial Attacks
• VisualBERT: A Simple and Performant Baseline for Vision and Language
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• BAE: BERT-based Adversarial Examples for Text Classification
• Black-box Adversarial Attacks with Limited Queries and Information
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Supervised Multimodal Bitransformers for Classifying Images and Text
• The Hateful Memes Challenge: Detecting Hate Speech in Multimodal Memes
• On Adaptive Attacks to Adversarial Example Defenses
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• HotFlip: White-Box Adversarial Examples for Text Classification
• BERT-ATTACK: Adversarial Attack Against BERT Using BERT
• Combating Adversarial Misspellings with Robust Word Recognition